Samsung SDS Announces This Year's 'Top 5 Cybersecurity Threats'... AI Security, Ransomware, and More

"Enterprise-Wide Crisis Management Strategies Needed"

Samsung SDS (Samsung SDS) announced on the 18th that it has analyzed cyber security issues that occurred domestically and internationally last year and revealed the top 5 cyber security threats to watch out for in 2025.

This year's top 5 cyber security threats include ▲ Artificial Intelligence (AI) security threats ▲ Cloud security threats ▲ Ransomware attacks ▲ Software (SW) supply chain security threats ▲ Operational Technology (OT) and Internet of Things (IoT) security threats in production facilities. Samsung SDS selected these threat factors and proposed solutions after gathering opinions from over 400 security experts in manufacturing, finance, logistics sectors, as well as public and defense sectors.

First, AI security threats were selected. The number of companies actively utilizing generative AI has increased since this year, leading to a rise in security threats within enterprises. Samsung SDS explains that to respond to phishing attacks or malware damage exploiting AI, it is necessary to build AI-based threat detection, analysis, and protection systems. Proactive response through an 'intelligent security monitoring system' aligned with the pace of AI development is also required.

Cloud security threats caused by long-neglected credentials are also problematic. Companies are increasing their use of cloud infrastructure to adopt new technologies and services such as generative AI and data analytics. However, incorrect cloud configuration changes, exposure of long-neglected credentials, and security settings of existing system versions can lead to security incidents. Credentials refer to information (ID, password, certificate, etc.) or proofs submitted by users to verify their identity. Samsung SDS emphasized the need to introduce security platforms suitable for cloud environments to prevent these issues.

Ransomware has evolved into a double extortion strategy, increasing the damage. This method involves hacking devices to encrypt data while simultaneously threatening to disclose stolen information. Recently, RaaS (Ransomware as a Service) has emerged, allowing ransomware attacks without specialized programming knowledge, simply by paying a fee. Samsung SDS explained that companies should strengthen external access and account management, and regularly protect and manage data to prevent ransomware risks.

The 'SW supply chain security threat' caused by malware infiltration during development using open source software is also a factor to be cautious about. Open source means that the source code of software is publicly available for anyone to use. Companies have recently been developing and operating by utilizing external resources such as open source, which makes malware infiltration easier and increases security threats. Malware can also infiltrate through SW updates. To prevent this, it is necessary to establish audit and response plans covering the entire SW and IT environment.

Security threats related to production facilities and associated systems (OT) connected to the internet, as well as interconnected environments among computing devices, objects, and wearable devices (IoT), are also increasing. Unupdated OT and IoT devices are vulnerable to hacking attacks, which can escalate into breaches affecting the entire connected network. Samsung SDS emphasized that adherence to principles such as authentication procedures and regular security updates is essential to prevent this.

Jang Yong-min, Executive Director of Security Business at Samsung SDS, stated, "Security threats using AI technology are already becoming intelligent and sophisticated, requiring enterprise-wide crisis management strategies." He added, "To respond to this, companies must adopt AI-based intelligent security solutions, configure cloud platforms suitable for their own environments, strengthen access to corporate information systems, manage partner IT and security systems, and approach from an organizational perspective including strong authentication and regular security updates, as well as comprehensive management of IT environments and security systems for partners."